dns.pizza
Daily zone census

92,551 domains were born on Monday, August 31, 2026

92,551
domains appeared
110,535
domains left the zone
23.7%
had a live website by day's end
564
flagged high or critical

On Monday, August 31, 2026 the census compared 1,052 zone files holding 75,885,306 domains against the day before. 92,551 names were new (0.122% of the universe), 110,535 were gone, net -17,984. Every new name was probed once over HTTP, honouring robots.txt, to see what was behind it. See the newest day.

New domains per day

Aug 20Sep 2

Each bar is a day; click one to open it. The census covers the gTLD zones ICANN's zone-data service publishes plus a sample of .com and .net.

What was behind the new names

  • Active website21,894 23.7%
  • Parked or for sale1,869 2.0%
  • Registered, no site yet15,292 16.5%
  • Nothing there at all29,162 31.5%
  • Couldn't tell24,334 26.3%

What the 21,894 live sites are about

Unclassified6,299 · 28.8%
Hosting & domains3,758 · 17.2%
Gambling & casino3,039 · 13.9%
E-commerce & retail2,047 · 9.3%
SaaS & tech813 · 3.7%
Blogs & personal570 · 2.6%
Gaming553 · 2.5%
Adult383 · 1.7%
Crypto Web3364 · 1.7%
Education343 · 1.6%
AI software304 · 1.4%
Real estate302 · 1.4%

Where the new names landed

TLDBornGoneFlagged /1k
.top11,43612,5696.4
.online6,7404,9153.6
.org6,6397,1081.8
.shop5,7209,1562.1
.site4,6792,6652.4
.xyz4,40529,7878.4
.store4,1204,1674.4
.info3,6855,9281.9
.app3,2351,2222.8
.vip2,4522,5921.6
.pro2,1141,2880.9
.lol1,9141,1998.9
.cyou1,8271,0183.3
.click1,8011,0086.1
.fun1,4509384.1
.dev1,3865181.4
.cfd1,3622,19111.0
.live1,2891,1843.9
.sbs1,2731,3386.3
.space1,1766723.4
.icu1,1211,15616.9
.tech8485191.2
.casino827750.0
.cloud7925175.1
.help7811575.1

Top 25 of 489 TLDs with a birth or death that day. Full table: /api/zone/census/tlds?day=2026-08-31.

Who is parking them

Dan992
Atom92
Sav53
NameBright51
Domeneshop24
Sedo13
Epik3
Afternic2

What the live sites are built with

WordPress2,235
Vercel1,525
Shopify243
Wix87
Next.js68
Squarespace61
Webflow9
GitHub Pages8
Drupal4
Framer2

Writing system of the live sites

latin19,385
han1,130
cyrillic578
arabic304
thai194
hangul160
hebrew38
hiragana35

How old the departed names were

1–2 years446
2–5 years49
6–30 days73
1–3 months40
over 5 years15
3–12 months226
0–5 days (add-grace return)2
~1 year (first renewal lapse)113

Risk signals

Every one of the 219,506 births was scored on its name, its nameservers and registrar, and the page it served. 6,851 scored at all; 32 critical, 532 high, 1,546 medium, 4,741 low. The top 300 were screenshotted and shown to a model, which called 152 of them phishing, scam or abuse and 101 benign.

TLDs with the most flagged births per 1,000

.mom23.1 · 3 of 130
.cam21.4 · 12 of 560
.win18.4 · 7 of 380
.icu16.9 · 19 of 1,121
.wiki16 · 4 of 187
.bid12.1 · 2 of 165
.cfd11 · 15 of 1,362
.link9.2 · 2 of 217
.lol8.9 · 17 of 1,914
.today8.5 · 2 of 117

Signals that fired most

brand in page title, not in the name1,265
TLD with a high abuse rate1,176
brand name at a retail registrar518
form on a brand-styled page508
brand in the name387
punycode name283
brand name at a watch-list registrar200
brand name behind Cloudflare143
one-letter brand typo121
lure words (login, verify, secure…)78
brand plus digits75
identical page on many newborns74

Brands most often echoed in new names

icloud49
binance27
google25
tmobile22
amazon20
gmail19
ebay16
shopify16
robinhood16
tiktok14
vanguard14
roblox13

Registrars of flagged names

Dynadot Inc204
NameCheap, Inc.197
HOSTINGER operations, UAB134
Porkbun LLC116
GoDaddy.com, LLC116
Spaceship, Inc.110
Name.com, Inc.96
Cloudflare, Inc.74
NameSilo, LLC70
Atak Domain Bilgi Teknolojileri A.Ş.64

Worth a second look

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

Criticalamazon-en.topscore 99echoes amazon· active website
brand in the name “amazon”TLD with a high abuse rate “top”brand name at a retail registrar “Dynadot LLC”brand name at a watch-list registrar “Dynadot LLC”+3 more

Model opinion: looks like phishing (target: Amazon), confidence 95%. An opinion, not a finding.

Criticalshopee1.cyouscore 99echoes shopee· active website
brand in the name “shopee”brand plus digits “shopee1”TLD with a high abuse rate “cyou”brand name behind Cloudflare “cloudflare.com”+4 more

Model opinion: looks like phishing (target: Shopee), confidence 97%. An opinion, not a finding.

Criticalcloud-privacy.xyzscore 96echoes icloud· active website
one-letter brand typo “cloud≈icloud”TLD with a high abuse rate “xyz”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “Dynadot Inc”+3 more

Model opinion: looks like abuse, confidence 66%. An opinion, not a finding.

Criticalntflix.shopscore 88echoes netflix· active website
one-letter brand typo “ntflix≈netflix”page impersonates a brand “Netflix”brand in page title, not in the name “netflix”form on a brand-styled page “has_form”

Model opinion: looks like a scam (target: Netflix), confidence 82%. An opinion, not a finding.

Critical1lloyds.comscore 85echoes lloyds· active website
brand in the name “lloyds”brand plus digits “1lloyds”brand name on a rarely-seen nameserver “awsdns-24.org”brand name at a retail registrar “Amazon Registrar, Inc.”+2 more

Model opinion: looks benign, confidence 93%. An opinion, not a finding.

Critical4ktiktok.websitescore 85echoes tiktok· active website
brand in the name “tiktok”brand plus digits “4ktiktok”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”+2 more

Model opinion: looks benign, confidence 75%. An opinion, not a finding.

Criticalamazon-deals.todayscore 77echoes amazon· active website
brand in the name “amazon”brand name at a retail registrar “GoDaddy.com, LLC”brand name and brand-styled page “amazon”form on a brand-styled page “has_form”+1 more

Model opinion: looks benign, confidence 62%. An opinion, not a finding.

Criticalphantom-vpn.topscore 74echoes phantom· active website
ambiguous brand word “phantom”TLD with a high abuse rate “top”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NICENIC INTERNATIONAL GROUP CO., LIMITED”+3 more

Model opinion: looks benign, confidence 72%. An opinion, not a finding.

Criticalrobinhoodstar.appscore 71echoes robinhood· active website
brand in the name “robinhood”brand name at a retail registrar “Name.com, Inc.”brand name and brand-styled page “robinhood”form on a brand-styled page “has_form”

Model opinion: looks like a scam, confidence 62%. An opinion, not a finding.

Criticaltuguiamazon.comscore 71echoes amazon· active website
brand in the name “amazon”brand name at a retail registrar “Name.com, Inc.”brand name and brand-styled page “amazon”form on a brand-styled page “has_form”

Model opinion: looks benign, confidence 65%. An opinion, not a finding.

Criticalhodyachie-mertvetsy.monsterscore 70echoes etsy· active website
brand in the name “etsy”TLD with a high abuse rate “monster”brand name on a rarely-seen nameserver “dreamsdns.com”brand name at a retail registrar “Registrar of Domain Names REG.RU LLC”+1 more

Model opinion: looks like abuse, confidence 85%. An opinion, not a finding.

Criticalermesssop.infoscore 68· active website
page asks for credentials “Log In to Your Account”brand in page title, not in the name “sharepoint”form on a brand-styled page “has_form”

Model opinion: looks like phishing (target: Microsoft SharePoint), confidence 96%. An opinion, not a finding.

Criticalvanguardacursos.storescore 68echoes vanguard· active website
brand in the name “vanguard”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “NameCheap, Inc.”brand name at a watch-list registrar “NameCheap, Inc.”+1 more

Model opinion: looks like abuse, confidence 85%. An opinion, not a finding.

Criticalworldwidesmmpanel.shopscore 68· active website
page asks for credentials “log in to your account”brand in page title, not in the name “instagram”form on a brand-styled page “has_form”

Model opinion: looks like abuse, confidence 60%. An opinion, not a finding.

Criticaltelegram-ka9.vipscore 67echoes telegram· active website
brand in the name “telegram”brand plus digits “telegram-ka9”brand name behind Cloudflare “cloudflare.com”brand name at a retail registrar “July Name Limited”+1 more

Model opinion: looks like phishing (target: Telegram), confidence 60%. An opinion, not a finding.

See all 564 high and critical rows for 2026-08-31

About this data

The census diffs the zone files ICANN's Centralized Zone Data Service publishes for about a thousand gTLDs, plus a sample of .com and .net, against the previous day. A birth is a name present today and absent yesterday; a death is the reverse. Births are probed once over HTTP with an identified user agent, robots.txt honoured, and classified by what came back. Subjects are assigned by a language model reading the page text. The risk scorer is deterministic and additive; its weights and word lists are public in the API's reasons field.

Aggregates and named rows are free as JSON: API docs. Per-domain answers are also on every domain report. Names in .com and .net are counted in every aggregate but not listed by name until the redistribution terms of that zone's access agreement are confirmed.